Method for Operating a Driver Assistance System of a Vehicle and Driver Assistance System for a Vehicle

ABSTRACT

A method for operating a driver assistance system of a vehicle is disclosed, wherein sensor data are recorded from the surroundings of the vehicle, the recorded sensor data are verified, the verified sensor data are analyzed by a neural network and analyzed sensor data are generated. Based on the analyzed sensor data, control data are generated for controlling the vehicle. During verification of the sensor data, at least first sensor data, which were recorded at a first, earlier point in time, are compared with second sensor data, which were recorded at a second, later point in time, the result of the comparison is cross-checked with a database in which data on perturbations to input data of a neural network are stored, wherein it is checked whether the second sensor data were generated at least in part by a perturbation to the first sensor data that is stored in the database.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to German Patent Application No. DE 102019 208 735.3, filed on Jun. 14, 2019 with the German Patent andTrademark Office. The contents of the aforesaid Patent Application areincorporated herein for all purposes.

TECHNICAL FIELD

The present invention relates to a method for operating a driverassistance system of a vehicle, in which sensor data are recordedsuccessively from the surroundings of the vehicle. The recorded sensordata are verified. The verified sensor data are then analyzed by meansof a neural network. As a result, analyzed sensor data are generated.Based on the analyzed sensor data, control data are generated forcontrolling the vehicle in a partially automated or fully automatedmanner. Furthermore, the invention relates to a driver assistance systemfor a vehicle, comprising a sensor unit arranged in the vehicle forrecording sensor data of the surroundings of the vehicle.

BACKGROUND

This background section is provided for the purpose of generallydescribing the context of the disclosure. Work of the presently namedinventor(s), to the extent the work is described in this backgroundsection, as well as aspects of the description that may not otherwisequalify as prior art at the time of filing, are neither expressly norimpliedly admitted as prior art against the present disclosure.

Modern vehicles comprise driver assistance systems, which assist thedriver with control of the vehicle or which partially or completely takeover the task of driving. By using driver assistance systems of thiskind, various levels of vehicle control automation may be achieved. Inthe case of a low automation level, information and warnings are merelyoutput to the driver. In the case of higher automation levels, thedriver assistance system actively intervenes in the control of thevehicle. For example, the steering of the vehicle or the acceleration inthe positive or negative direction is intervened with. In the case of aneven higher automation level, apparatuses of the vehicle are intervenedwith such that certain locomotion types of the vehicle, for examplestraight-ahead driving, may be executed automatically. In the case ofthe highest automation level, the vehicle may drive autonomously.

In driver assistance systems of this kind, the analysis of digitalimages recorded from the surroundings of the vehicle during travel is ofessential importance. The driver assistance system may only control thevehicle in a reliable manner if the digital images are analyzedcorrectly. Machine learning has great potential for the analysis ofdigital images of a driver assistance system. The raw sensor datagenerated, for example, by a camera, a radar sensor, or a lidar sensorof a vehicle are processed by means of a deep neural network. The neuralnetwork generates output data from which the driver assistance systemderives relevant information for the partially automated or fullyautomated driving. For example, the type and position of objects in thesurroundings of the vehicle and their behavior are determined.Furthermore, by means of neural networks, the geometry and topology ofthe roadway may also be determined. Convolutional neural networks, inparticular, are particularly suitable for processing digital images.

Deep neural networks of this kind are trained for use in a driverassistance system. In the process, the parameters of the neural networkmay be suitably adapted by inputting data without the need forintervention on the part of a human expert. For a givenparameterization, this involves measuring the deviation of an output ofa neural network from a basic truth. This deviation is also referred toas “loss”. A so-called loss function is chosen in such a way that theparameters depend thereon in a differentiable manner. Within the contextof gradient descent, the parameters of the neural network are thenadjusted in each training step depending on the derivative of thedeviation, which is determined on the basis of several examples. Thesetraining steps are repeated until the deviation, i.e. the loss, nolonger decreases.

In this approach, the parameters are determined without the assessmentof a human expert or semantically motivated modeling. This results inthe neural networks often being largely opaque to humans and theircalculations being uninterpretable. As a result, deep neural networks,in particular, often cannot be systematically tested or formallyverified.

Furthermore, it creates a problem of deep neural networks beingsusceptible to adversarial perturbations. Slight tampering of the inputdata that may barely be perceived or that cannot be perceived at all bya human or tampering that does not alter the situation assessment maylead to output data that differ significantly from the output data thatwould result without the tampering. Tampering of this kind may be bothwillfully induced changes to the sensor data as well as randomlyoccurring image changes caused by sensor noise, weather influences, orcertain colors and contrasts.

It is not possible to predict the input features to which a neuralnetwork will react so sensitively as for the output data to changesignificantly even in the event of minor changes to the input data. As aresult, synthetic data cannot be used successfully for training neuralnetworks used in driver assistance systems of this kind. It has beenshown that neural networks that were trained in simulations or based onother synthetic data exhibit poor performance when used in a driverassistance system with real sensor data. Moreover, it has also beenfound that implementing a driver assistance system with a neural networkin another domain may significantly reduce the functional quality. Forexample, a driver assistance system having a neural network that wastrained in the summer may be unsuitable for use in the winter. Thedevelopment and release of neural networks for driver assistance systemsbased on a simulation is therefore problematic.

There is therefore a need to develop neural networks for driverassistance systems that are robust to perturbations. The neural networksshould also generate output data that may be used for the driverassistance system even if the input data have been perturbed.

When using the neural network in a driver assistance system, it shouldalso be identified whether the recorded sensor data are authentic. Itshould be possible for the sensor data to be verified reliably. Itshould in particular be identified whether the sensor data have beenaltered by an adversarial perturbation.

SUMMARY

A need exists to provide a method and a driver assistance system of thetype mentioned at the outset in which the recorded sensor data areverified reliably.

The need is addressed by a method and a driver assistance system havingthe features of the independent claims. Embodiments of the invention aredescribed in the dependent claims, the following description, and thedrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 schematically shows a structure of an exemplary embodiment of adriver assistance;

FIG. 2 schematically shows an exemplary embodiment of a method foroperating a driver assistance system in a vehicle;

FIG. 3 schematically shows a structure of an exemplary generator forgenerating perturbed input data;

FIG. 4 schematically shows an exemplary method for generating perturbedinput data;

FIG. 5 shows an example of a perturbation;

FIG. 6 schematically shows the structure of an exemplary device forgenerating a set of parameters; and

FIG. 7 shows an exemplary method for improving a set of parameters of aneural network.

DESCRIPTION

The details of one or more embodiments are set forth in the accompanyingdrawings and the description below. Other features will be apparent fromthe description, drawings, and from the claims.

In the following description of embodiments of the invention, specificdetails are described in order to provide a thorough understanding ofthe invention. However, it will be apparent to one of ordinary skill inthe art that the invention may be practiced without these specificdetails. In other instances, well-known features have not been describedin detail to avoid unnecessarily complicating the instant description.

In a method for operating a driver assistance system of a vehicleaccording to a first exemplary aspect, sensor data are recordedsuccessively from the surroundings of the vehicle. The recorded sensordata are verified. During verification of the sensor data, at leastfirst sensor data, which were recorded at a first, earlier point intime, are compared with second sensor data, which were recorded at asecond, later point in time. The result of the comparison iscross-checked with data of a database in which the data on perturbationsto input data of a neural network are stored, wherein it is checkedwhether the second sensor data were generated at least in part by meansof a perturbation to the first sensor data that is stored in thedatabase. The verified sensor data are then analyzed by means of aneural network. As a result, analyzed sensor data are generated. On thebasis of the analyzed sensor data, control data are then generated forcontrolling the vehicle in a partially automated or fully automatedmanner.

In the method, the sensor data recorded from the surroundings of thevehicle are reliably verified based on perturbations stored previouslyin a database. In this way, it is possible to reliably identify knownadversarial perturbations for neural networks that are used in a driverassistance system when using the neural network in a driver assistancesystem. The perturbations may in particular be detected in real time. Inthis way, it is also possible to distinguish temporal changes to thesensor data caused by natural changes in the environment of the vehiclefrom adversarial perturbations.

The sensor data are in particular digital images of a camera of thevehicle. The digital images record the surroundings of the vehicle. Thesensor data are in particular raw sensor data, in particular raw sensordata of the camera.

Furthermore, the sensor data may be data generated by a radar sensor orlidar sensor. In this case, too, the sensor data are in particular rawsensor data.

The database in which the data relating to perturbations to input dataof the neural network are stored is in particular arranged in thevehicle. Therefore, when cross-checking the comparison of the sensordata recorded at different points in time with the database, thedatabase may be accessed directly, i.e., without a wireless interface.This ensures that the cross-checking may be carried out at any time inthe vehicle, even when the vehicle has no data connection to externalapparatuses.

The data stored in the database in particular describe naturallyoccurring perturbations. These may for example be weather influences,such as fog or snow, sensor noise, camera soiling, or changes caused bytextures. Furthermore, naturally occurring perturbations are naturallyoccurring objects in the surroundings of a vehicle, for example printedposters or stickers on objects. Alternatively, other perturbations, forexample artificial perturbations, may also be stored in the database,wherein a classification of the perturbations is additionally stored,such that, during the cross-checking of the result of the comparison ofthe sensor data recorded at different points in time with the database,it may be checked whether a change to the sensor data was caused by anaturally occurring perturbation or another, for example artificial, inparticular adversarial, perturbation.

For example, if a pattern or grid is superimposed on the sensor data inthe event of an adversarial perturbation, this may be detected by theverification by means of a plausibility check, since patterns or gridsof this kind are not naturally occurring perturbations.

If the cross-check reveals that changes to the sensor data were causedby a naturally occurring perturbation, the sensor data may be verified.If this is not the case, there is a high probability that the change tothe sensor data was caused by an adversarial perturbation. In this case,the sensor data are not verified and these sensor data are then not usedfor generating the analyzed sensor data by means of the neural network.

In some embodiments, the verified sensor data are checked forplausibility in that supplementary sensor data are obtained from thesurroundings of the vehicle, the supplementary sensor data are analyzed,deviations of the second sensor data from the first sensor data aredetermined, and it is checked whether the deviations are in line withthe analysis of the supplementary sensor data. One cause for deviationsin the sensor data recorded at different points in time is the movementof the vehicle relative to the surroundings. However, in addition tothese deviations associated with the movement of the vehicle, deviationsthat result from a change in the environment may also be created. Bymeans of the supplementary sensor data, it may be checked whether theseother deviations are caused by such environmental changes. By means ofthe plausibility check, an adversarial perturbation that corresponds toor resembles a naturally occurring perturbation may be identified. Forexample, if the sensor data reveal that the weather conditions havechanged such that fog appears in the surroundings of the vehicle, theplausibility of this may be checked by means of the supplementary sensordata. For example, if an optical sensor shows that there is no fog,i.e., that visibility is good, it may be recognized that the changes tothe sensor data that could have been caused by fog were actually causedby an adversarial perturbation. By means of the plausibility check ofthe sensor data, the verification of the sensor data obtained may beimproved further. As a result, the reliability during use of the methodin a driver assistance system is increased.

During the analysis of the supplementary sensor data, visibilityconditions in the surroundings of the vehicle are obtained, inparticular. It is then checked whether the deviations of the secondsensor data from the first sensor data at least partially result fromthe visibility conditions in the surroundings of the vehicle. Thevisibility conditions in the surroundings of the vehicle may be checkedin a particularly simple manner by means of sensors that are usuallyalready present in the vehicle, and independently of the sensors of thedriver assistance system. In this way, an adversarial perturbation ofthe driver assistance system may be detected by sensors that are notdirectly used by the driver assistance system to generate the controldata. This also increases the reliability during operation of the methodin a driver assistance system.

In some embodiments, an improved set of parameters of the neural networkused in the method is generated by means of the following steps:

-   -   a. providing a neural network with the associated set of        parameters,    -   b. generating training data by means of an example sensor data        set,    -   c. generating a first analysis of the example data set on the        basis of the training data by means of the neural network,    -   d. generating perturbed input data as training data for the        example sensor data set by means of the above-described method        for generating perturbed input data for a neural network,    -   e. generating a second analysis of the example sensor data set        on the basis of the perturbed input data by means of the neural        network,    -   f. comparing the first and second analysis, and    -   g. generating an improved set of parameters for the neural        network on the basis of the result of the comparison of the        first and second analysis.

The example sensor data set is in particular an example digital image.The sensor data used to improve the set of parameters are previouslyobtained sensor data that are used to train the neural network. However,these sensor data may show similar sensor data, for example similardigital images, to those generated in the field during use of the methodin a driver assistance system.

The improved set of parameters may therefore be obtained by training theneural network. The training is carried out for perturbed andunperturbed sensor data, i.e., digital images, in particular. Theimproved set of parameters therefore results from a gradient descent(adversarial training), for example.

In these embodiments, the perturbed input data may in particular begenerated in that a first metric is defined, which specifies how theextent of a change to a digital image is measured, and in that a secondmetric is defined, which specifies what a perturbation of the input dataof a digital image is directed at. An optimization problem is thengenerated from a combination of the first metric and the second metric.The optimization problem is solved by means of at least one solutionalgorithm, wherein the solution specifies a target perturbation of theinput data, and perturbed input data are generated for the neuralnetwork from sensor data by means of the target perturbation.

The sensor data are in particular digital images. Therefore, in thiscase, the target perturbation generates perturbed, i.e., altered,digital images, which form the input data for the neural network thatanalyzes the digital image.

In the method according to the present exemplary aspect, possibleadversarial perturbations of a neural network used to analyze sensordata are considered at a structural level. The perturbation isconsidered as a composition of different elements for which differentmetrics are defined. Surprisingly, this had the result that randomlycomposed perturbations are no longer exclusively used, but rather itbecomes possible to generate a large number of new adversarial targetperturbations based on known perturbations by analyzing the structure ofknown perturbations with regard to the metrics.

In the method, an optimization problem is generated from two metricsthat measure changes to sensor data, in particular a digital image.There is a large number of known solution algorithms for an optimizationproblem of this kind. The optimization problem may therefore be solvedby means of these solution algorithms. As a result, a targetperturbation of the input data is generated. By means of this targetperturbation, perturbed input data may then be generated for the neuralnetwork from sensor data. The neural network may then be tested andtrained based on these perturbed input data. Beneficially, the methodaccording to the present exemplary aspect makes it possible to generatenew perturbations in a very quick and simple manner.

The first metric used in the method specifies how the extent of a changeto sensor data is measured. If the sensor data is a digital image of acamera, the perturbation for testing the neural network should usuallybe as small as possible. The first metric specifies how the extent ofthe change to the digital image may be quantified. For example, adigital image may be changed in that the pixels of the image areshifted, rotated, or reflected. The first metric specifies the extent ofthe change during such transformations. A rotation or translation of adigital image may be defined according to the first metric by means of afixed point and the angle of rotation or the distance of translation inthe horizontal and vertical direction. Furthermore, for each pixel ofthe image, the first metric may determine the image distances bydetermining the sum of the differences of all pixel values. The pixelvalue may for example be a gray scale value or a color value. For eachpixel, the difference of the pixel value is formed for the originalimage and for the perturbed image. This difference is determined foreach pixel and the differences are then added together. This results inan image distance that specifies the difference between the two imagesaccording to the first metric.

Furthermore, altered image regions may also be considered according tothe first metric. The image regions may be defined by a starting pointand an extension in the horizontal and vertical direction, or by a listof pixels. Image distances may be determined for these image regionsaccording to the first metric.

Furthermore, the first metric may specify the extent of a change to adigital image in relation to image characteristics, for exampleluminance, contrast, and/or structure values, or any combinationsthereof.

Restrictions may also be applied when defining the first metric, forexample that the changes that are considered for the first metric onlytake into account image regions in which specific image characteristicsare present, for example. For example, only regions in which thecontrast exceeds a defined threshold value may be considered.

In some embodiments, the second metric relates to a change in theclassification of objects. In particular, it measures the deviation ofthe true model output from the desired false model output, i.e., thetarget of the adversarial perturbation. For example, in the case of adigital image, small image regions or a small number of pixels may beperturbed such that an object in the digital image is no longer detectedas a road user, for example a pedestrian, but rather as an otherwiseclassified object, for example a region of a roadway. Furthermore, theperturbation may be directed toward always detecting a road as an emptyroad without other road users whenever a region is detected as a road.

In some embodiments, the second metric may be directed at thedisappearance of objects. For example, the perturbation is directedtoward changing detected objects such that they disappear. The secondmetric may also relate solely to specific image regions. For example,the perturbation described by the second metric may be directed towardprohibiting objects of a specific class from appearing in a specificimage region.

In some embodiments, the second metric relates to a change to an objectof a specific class. For example, an object may be detected andclassified. For example, an image region may be assigned to a road user.The second metric is then directed, for example, toward displaying saidobject larger or smaller or at a different position. For example,objects classified as pedestrians may be displayed larger or smaller.The enlargement is in this case defined by the absolute number of pixelsby which the object is enlarged or reduced in size by the perturbationon the left, on the right, at the top or at the bottom.

There are a wide variety of possible perturbations that may be describedby the second metric. Any changes may be made to the sensor data inorder to alter the sensor data such that safety-related results, inparticular, may no longer be obtained correctly during the analysis ofthe sensor data in a driver assistance system. For example, a pattern ora grid may be applied to the sensor data such that, in the case of adigital image, objects of a specific class, such as pedestrians,disappear, whereas other objects continue to be classified correctly. Inparticular, second metrics that measure the naturally occurringperturbations are relevant for the application of the method accordingto the present exemplary aspect in a driver assistance system: the modeloutput appears plausible, but deviates from the truth in certain,safety-related details.

In some embodiments, the perturbations described by the first and/orsecond metric are naturally occurring perturbations. Therefore, forapplication in a driver assistance system, a selection is made for thepossible perturbations described by the first and/or second metric thatis especially relevant for checking and improving neural networks foruse in a driver assistance system.

In some embodiments, the first and/or second metrics are stored in adatabase. A data set relating to a naturally occurring perturbationmeasured using the first and/or second metric is then loaded from thedatabase. The metrics for possible perturbations to the input data(first metrics) and for possible changes to the model outputs (secondmetrics) may for example be stored in the database. In some embodiments,a data set relating to a naturally occurring perturbation (measuredusing a first metric) and for a possible target (a notified change tothe model output—e.g. overlook all pedestrians—measured using a secondmetric) is then loaded from the database.

In some embodiments, the perturbed input data may in particular also begenerated by defining a first group containing first metrics that eachprovide a different specification as to how the extent of a change tosensor data is measured and by defining a second group containing secondmetrics that each provide a different specification as to what aperturbation of sensor data is directed at, by selecting any combinationof a first metric from the first group and a second metric from thesecond group, by generating an optimization problem from the selectedcombination of the first and second metric, by solving the optimizationproblem by means of at least one solution algorithm, wherein thesolution specifies a target perturbation of the input data, and bygenerating perturbed input data for the neural network from sensor databy means of the target perturbation.

The benefit of this method is that any first metric from the first groupand any second metric from the second group may be used to arrive at atarget perturbation by solving the optimization problem. The moremetrics the first and second group contain, the more different targetperturbations may be generated by the method. As such, a very largenumber of target perturbations may be generated.

In some embodiments, the first group comprises at least two, inparticular at least five, different first metrics. However, the firstgroup may also contain more than 10, 20, or more than 100 metrics.

In some embodiments, the second group comprises at least two, inparticular at least five, different second metrics. However, the secondgroup may also contain more than 10, 20, or more than 100 metrics.

The first and/or the second metric of the first or second group may inparticular comprise the features of the like described above inisolation or in combination.

In some embodiments, a third metric is defined, which specifies whattype of sensor data a third perturbation is used for. For example, theperturbation is applied to all data, to only one data point, or to datameeting certain conditions, for example all data involving multi-laneroads. The optimization problem is then generated from a combination ofat least two metrics from the first, second and third metric. Inparticular, the optimization problem is generated from a combination ofthe first, second and third metric. The sensor data are in particulardigital images. These are analyzed by means of a neural network in adriver assistance system, in particular.

The third metric may in particular relate to all sensor data, forexample all digital images. For example, the perturbation may causeobjects of a specific class to disappear in all digital images.

Moreover, the third metric may only affect a subset of the sensor data,in particular of the digital images. The perturbation may for exampleonly describe digital images that contain objects of a specific class,for example objects classified as pedestrians. Furthermore, the thirdmetric may describe digital images that were recorded on days withsnowfall or rain. As a result, the perturbed input data for the neuralnetwork may, for example, produce a different assessment of a specifictraffic situation or environmental situation when used in a driverassistance system.

In some embodiments, the third metric only describes sensor data thatcontain a specific object. Alternatively or additionally, the thirdmetric may select only one specific digital image.

In some embodiments, any combination of a first metric from the firstgroup, a second metric from the second group, and the third metric isselected. The optimization problem is then generated from the selectedcombination of the first, second, and third metric.

The third metric may in particular comprise the features as describedabove in isolation or in combination.

The optimization problem, which has been generated on the basis of themetrics, may be represented as follows: In the event of a predefinedmaximum change to a digital image, for example by means of rotation of aspecific image region, the number of pixels classified as people is tobe minimized, and, specifically, for as many images as possible in whichpeople appear.

In another example, in the event of a minimal change to the input image,the number of pixels classified as a person is to be minimized inregions of high contrast, and, specifically, for as many images aspossible in which people appear.

In the method according to the present exemplary aspect, a solutionalgorithm is specified for optimization problems of this kind. In someembodiments, the solution algorithm comprises iterative methods usingthe gradients of the neural network to determine the directions ofchange. Furthermore, iterative methods using sampling, evaluation, andcombinations thereof may be used.

In some embodiments, a Monte Carlo method is used as the solutionalgorithm, in which, for example, noise is generated for a digitalimage, and the result is checked. In some embodiments, a geneticalgorithm may be used to solve the optimization problem.

The solution to the optimization problem may for example be a perturbeddigital image or a perturbation by means of which sensor data may beperturbed in order to generate perturbed input data for a neuralnetwork. The perturbed sensor data or the perturbed digital image thenconstitute the input data for the neural network to be checked. Aperturbation may also be applied to a set of input data by combining atthe pixel level, for example by means of summation.

If the sensor data are digital images, the first and second analysis mayinclude semantic segmentation of the digital image, detecting objects inthe digital image, classifying objects in the digital image, ordetecting the position of an object in the digital image. Moreover, theanalyses may be used to identify how an object in the digital imagechanges. These analyses are particularly relevant for use of the neuralnetwork in a driver assistance system, and therefore it is importantthat the neural network is robust to perturbations that occur duringsuch analyses, and thus that few changes occur during the analysis whenperturbed input data are used.

In some embodiments, a solution algorithm group is defined, whichcontains multiple solution algorithms that each provide a differentsolution to the optimization problem in order to generate differenttarget perturbations of the input data. Any solution algorithm from thesolution algorithm group is then selected in order to generate perturbedinput data for the neural network from sensor data. In this way, an evenlarger number of target perturbations may be generated, since thesolution algorithm may also be varied, wherein each solution algorithmarrives at different target perturbations.

The solution algorithms of the solution algorithm group may compriseiterative methods using the gradients of the neural network to determinethe directions of change as well as sampling-based methods,gradient-based methods, gradient-based methods with momentum, and/orsurrogate model-based methods.

The invention further relates to a driver assistance system for avehicle. The driver assistance system according to a further exemplaryaspect comprises a sensor unit arranged in the vehicle for recordingsensor data of the surroundings of the vehicle. Furthermore, itcomprises a verification unit for verifying the recorded sensor data,wherein the verification unit, during verification of the sensor data,is designed to compare at least first sensor data that were recorded ata first, earlier point in time with second sensor data that wererecorded at a second, later point in time, to cross-check the result ofthe comparison with data of a database in which data relating toperturbations of input data of a neural network are stored, wherein itis checked whether the second sensor data were generated at least inpart by means of a perturbation to the first sensor data that is storedin the database. Furthermore, the driver assistance system comprises anevaluation unit, which is coupled to the sensor unit and in which aneural network is stored and which is designed to analyze the verifiedsensor data by means of the neural network and thereby generate analyzedsensor data. Furthermore, the driver assistance system comprises acontrol unit, which is coupled to the evaluation unit and which isdesigned to generate control data for controlling the vehicle in apartially automated or fully automated manner on the basis of theanalyzed sensor data.

The driver assistance system is in particular designed to execute themethod according to the first aspect. It therefore has the samebenefits.

The data relating to perturbations of input data stored in the databasein particular comprise perturbed input data for a neural network of thelike also stored in the evaluation unit. Alternatively, however, datarelating to perturbations of input data for any desired neural networksmay also be stored in the database, and therefore the database may bedesigned for the use of various neural networks in the evaluation unit.

The sensor unit is in particular a camera for recording digital images.The digital images thus record the surroundings of the vehicle. Thecamera is in particular arranged in the vehicle. Similarly, the databaseis for example also arranged in the vehicle and coupled to theverification unit via a wire connection.

In some embodiments of the driver assistance system, the verificationunit is designed to determine deviations of the second sensor data fromthe first sensor data. Furthermore, according to these embodiments, thedriver assistance system comprises a supplementary sensor unit, which isdesigned to obtain supplementary sensor data from the surroundings ofthe vehicle. The driver assistance system in particular also comprises aplausibility unit, which is coupled to the supplementary sensor unit andto the verification unit and which is designed to analyze thesupplementary sensor data and to check whether the deviations are inline with the analysis of the supplementary sensor data. In the process,it may in particular be checked whether the deviations may arise fromperturbations that were determined by analyzing the supplementary sensordata.

The invention will now be explained based on further exemplaryembodiments with reference to the FIGS.

Specific references to components, process steps, and other elements arenot intended to be limiting. Further, it is understood that like partsbear the same or similar reference numerals when referring to alternateFIGS. It is further noted that the FIGS. are schematic and provided forguidance to the skilled reader and are not necessarily drawn to scale.Rather, the various drawing scales, aspect ratios, and numbers ofcomponents shown in the FIGS. may be purposely distorted to make certainfeatures or relationships easier to understand.

An exemplary embodiment of the driver assistance system 20 will beexplained below with reference to FIG. 1.

The driver assistance system 20 comprises a sensor unit 21, which isarranged in the vehicle. The exemplary embodiment is a camera thatrecords digital images of the surroundings of the vehicle. When thevehicle is being used, said digital images may be generatedsuccessively.

The sensor unit 21 is connected to a verification unit 22. Theverification unit 22 may verify the sensor data recorded by the sensorunit 21, i.e. determine whether undesired changes, in particularadversarial perturbations, have affected the sensor data. In this way,the sensor data are also authenticated, i.e. the unchanged origin of thesensor data from the sensor unit 21 is checked. For this purpose, theverification unit 22 compares sensor data that were recorded atdifferent points in time, in particular successive sensor data sets. Forexample, two successive sensor data sets may be compared. However, it isalso possible for a large number of successive sensor data sets to becompared in order to identify changes. The verification unit 22determines deviations of sensor data recorded later from sensor datarecorded earlier.

The verification unit 22 is coupled to a database 16. Data relating toperturbations to input data of a neural network are stored in thedatabase 16. The database 16 distinguishes between whether theperturbation is a natural perturbation and whether this is not the case.A natural perturbation is understood to be a perturbation thatinfluences sensor data, in the present case digital images, of thesurroundings of the vehicle in the same way as they may be caused bynaturally occurring phenomena in the surroundings of the vehicle.

The change to a digital image caused by a natural perturbationcorresponds, for example, to the change to a digital image of the likethat results from the occurrence of weather phenomena such as fog,snowfall, or rain. Furthermore, natural perturbations are understood tobe image changes in which objects are inserted into the image ordisappear from the image, as may also occur in the surroundings of avehicle. For example, a poster or sticker on an object may appear in thesurroundings of the vehicle.

Other, unnatural perturbations include, in particular, adversarialperturbations of a neural network that are intended to disrupt reliableoperation of the driver assistance system. Such perturbations are markedin the database 16. In this way, the verification unit 22 may be used todetermine whether a change to sensor data was caused by a naturalperturbation or whether it is likely that the change was caused by anadversarial perturbation. The verification unit 22 is designed tocross-check the result of the comparison of the sensor data recorded atdifferent points in time with the data of the database 16. In theprocess, it may be checked whether the sensor data recorded later weregenerated at least in part by means of a perturbation to the firstsensor data that is stored in the database. If it turns out that thechanges were not caused by natural perturbations, the verification unit22 verifies the recorded sensor data and transmits same to aplausibility unit 23.

The plausibility unit 23 is connected to a supplementary sensor unit 24.Alternatively or additionally, the plausibility unit 23 may also beconnected to an interface 25 via which the supplementary sensor data maybe transmitted to the plausibility unit 23. For example, thesupplementary sensor unit 24 detects the visibility in the surroundingsof the vehicle, and, specifically, independently of the sensor unit 21designed as a camera. Alternatively or additionally, weather data mayalso be transmitted to the plausibility unit 23 via the interface 25.Based on this, the plausibility unit 23 may determine the visibility inthe surroundings of the vehicle.

The plausibility unit 23 may then analyze the supplementary sensor dataand check whether the deviations between the recorded sensor datadetermined by the verification unit 22 are in line with the analysis ofthe supplementary sensor data. If, for example, the verification unit 22reveals that the visibility in the surroundings of the vehicle hassignificantly reduced, since the digital images recorded by the sensorunit 21 show the emergence of fog, and the supplementary sensor datathat were transmitted from the supplementary sensor unit 24 or via theinterface 25 to the plausibility unit 23 show that clear visibilityconditions prevail, the plausibility check in the plausibility unit 23is negative. Even though the change to the recorded sensor data of thesensor unit 21 may have been caused by a natural perturbation, there isa high probability that this change was caused by an adversarialperturbation. In such a case, the implausible sensor data are notprocessed further.

The plausibility unit 23 is coupled to an evaluation unit 26. A neuralnetwork 11 is stored in the evaluation unit 26. The evaluation unit 26is designed to analyze the verified and plausible sensor data by meansof the neural network 11 and thereby generate analyzed sensor data. Thisanalysis takes place in a manner known per se. The digital images are,for example, semantically segmented and the detected objects in thedigital images are assigned to various classes. In this way, it ispossible to determine, for example, whether a pedestrian is on a roadwayand how said pedestrian is moving relative to the vehicle and relativeto the roadway.

The evaluation unit 26 is coupled to a control unit 27. The control unit27 is designed to generate control data for controlling the vehicle in apartially automated or fully automated manner on the basis of theanalyzed sensor data. Said control data are transmitted from the driverassistance system 20 to actuators 28, which control the steering and thepropulsion or braking of the vehicle, for example. Furthermore, theactuators 28 may control signals emanating from the vehicle. Partiallyautomated or fully automated control of the vehicle of this kind bymeans of a driver assistance system 20 is known per se.

An exemplary embodiment of the method for operating the driverassistance system 20 will be explained below with reference to FIG. 2:

In a step T1, sensor data are recorded successively from thesurroundings of the vehicle by means of the sensor unit 21.

In a step T2, first sensor data, which were recorded at a first, earlierpoint in time, are compared with second sensor data, which were recordedat a second, later point in time. A result of the comparison isproduced.

In a step T3, the result of the comparison is cross-checked with thedata of the database 16. In the process, it is taken into accountwhether the data of the database 16 are associated with perturbationsthat may have a natural cause or with adversarial perturbations.

In a step T4, it is checked whether the second sensor data weregenerated at least in part by means of a perturbation to the firstsensor data that is stored in the database. If said stored perturbationis a natural perturbation, the recorded sensor data are verified in astep T5.

In a step T6, the plausibility of the verified sensor data is checked.For this purpose, supplementary sensor data are obtained from thesurroundings of the vehicle and the supplementary sensor data areanalyzed. Furthermore, deviations of the second sensor data from thefirst sensor data are determined and it is checked whether thedeviations are in line with the analysis of the supplementary sensordata.

In a step T7, the verified and plausible sensor data are analyzed bymeans of a neural network 11. In a step T8, analyzed sensor data aregenerated thereby.

Finally, in a step T9, control data for controlling the vehicle in apartially automated or fully automated manner are generated on the basisof the analyzed sensor data and then output.

In one example of the exemplary embodiment of the method and in oneexample of the exemplary embodiment of the driver assistance system 20,a set of parameters for the neural network 11 used is obtained in aparticular manner. Perturbed input data that were obtained in a specificmanner are generated for training the neural network 11 prior to actualuse in a driver assistance system 20.

In this regard, an exemplary embodiment of the generator 10 forgenerating perturbed input data for a neural network for analyzingdigital images of the exemplary embodiment of the driver assistancesystem will be described in the following with reference to FIG. 3.

In the case of this exemplary embodiment, sensor data are analyzed by aneural network or perturbed input data are generated for a neuralnetwork from such sensor data. In the exemplary embodiments, the sensordata are raw data from sensors of a vehicle that were obtained prior toactual use of the neural network in a driver assistance system. Thesensor may be a camera, a radar sensor, a lidar sensor, or any othersensor that generates sensor data that are processed further in a driverassistance system. In the following, by way of example, the sensor dataare digital images recorded by a camera of a vehicle. However, othersensor data may also be used in the same way.

The generator 10 comprises a first metric unit 1, a second metric unit2, and a third metric unit 3. The first metric unit 1 comprises a firstmetric, which specifies how the extent of a change to digital images ismeasured. The first metric unit 1 defines how the extent of a change todigital images is measured. The definition of the first metric may beinput into the first metric unit 1. However, the first metric unit 1 mayalso access a database 16 via an interface, in which database data witha large number of possible definitions for metrics that measure theextent of a change to digital images is stored. For example, the firstmetric may compare the image distances between two digital images andoutput a value for said image distance. The image distance may forexample be defined by the sum of the differences of all pixel values ofthe digital images to be compared.

In the exemplary embodiment, the first metric unit 1 selects aperturbation that is as natural as possible from the database 16. Anatural perturbation is understood to be a perturbation that influencesdigital images of the surroundings of the vehicle in such a way as mayoccur on account of naturally occurring phenomena in the surroundings ofthe vehicle. The change to a digital image caused by a naturalperturbation corresponds, for example, to the change to a digital imageof the like that results from the occurrence of weather phenomena suchas fog, snowfall, or rain. Furthermore, natural perturbations areunderstood to be image changes in which objects are inserted into theimage or disappear from the image, as may also occur in the surroundingsof a vehicle. For example, a poster or sticker on an object may beinserted in the surroundings of the vehicle. Other, unnaturallyoccurring perturbations of the like that may also be contained in thedatabase 16 are not taken into account by the first metric unit 1, sincethese are less relevant for the testing of a neural network being usedin a driver assistance system.

The second metric unit 2 comprises a second metric, which specifies whata perturbation of the input data of the digital images is directed at,i.e. the second metric defines what a perturbation of a digital image isdirected at. The definition of the second metric may be transmitted bymeans of an input to the second metric unit 2. Equally, the secondmetric unit 2 may also be coupled to the database 16 in which datarelating to a large number of perturbations directed at a specificchange to digital images are stored. This may be collections of suchperturbations.

In the exemplary embodiment, the second metric unit 2 selects aperturbation that is as plausible as possible from the database 16. Aplausible perturbation is understood to be a perturbation that resultsin a seemingly realistic model output but that differs herefrom inrelevant details. In the case of a plausible perturbation, correctsegmentation, for example, takes place, but the lane markings have beenconsistently shifted. Other, implausible perturbations of the like thatmay also be contained in the database 16 are not taken into account bythe second metric unit 2, since these are less relevant for the testingof a neural network being used in a driver assistance system. Highlyimplausible model outputs may in fact be easily detected.

The second metric may for example be directed at increasing the size ofall objects assigned to a specific class, for example the class ofpedestrians. The perturbation therefore generates a digital image inwhich an object of the original image that is classified as a pedestrianis enlarged iteratively in all four directions, wherein the resultingsegmentation of the perturbed digital image is recombined. The result isa digital image in which all objects that do not belong to the class ofpedestrians remain unchanged, but objects that belong to the class ofpedestrians are shown enlarged. The other objects are only changedinsofar as they were changed by the enlargement of the objects of thepedestrian class.

The third metric unit 3 comprises a third metric that specifies whattype of digital images the perturbation is used for. For example, themetric may define that the perturbation is only applied to digitalimages that show other road users, i.e. pedestrians, cyclists, and othervehicles, for example.

The three metric units 1 to 3 are connected to a processing unit 4. Theprocessing unit 4 is designed to generate an optimization problem fromthe three metrics of the first to third metric unit 1 to 3. For example,the optimization problem comprises a loss function for a neural networkthat contains a perturbation parameter as a parameter and an imageresulting from the perturbation (second metric). With regard to theoptimization problem, the aim is to find the minimum of the perturbationparameter, and, specifically, for the digital images defined accordingto the third metric and with the proviso that the extent of the changeto the generated image relative to the original image according to thefirst metric is below a specific value.

The processing unit 4 transmits the optimization problem as a data setto a solution unit 5. The solution unit 5 is coupled to a database 6 inwhich at least one solution algorithm, for example a large number ofsolution algorithms, for optimization problems is stored. Solutionalgorithms of this kind are known per se. For example, Monte Carlomethods, genetic algorithms, and/or gradient-based methods may be storedin the database 6, which the solution unit 5 may access. By means ofthese solution algorithms, the solution unit 5 may generate a targetperturbation of the input data from digital images as the solution tothe optimization problem. The target perturbation thus generates aperturbed digital image, which may be used as input data for a neuralnetwork for analyzing digital images. The neural network is configured,in particular, to analyze digital images of a driver assistance system.

The solution unit 5 transmits the target perturbation to a generationunit 7. The generation unit 7 is further coupled to a database 8 inwhich a large number of digital images are stored. By means of thetarget perturbation, the generation unit 7 may perturb digital images ofthe database 8 in such a way that perturbed input data 9 of the digitalimages are generated for a neural network. The perturbed input data 9are then output by the generation unit 7. These perturbed input data 9may then be used to test or train a neural network or to improve the setof parameters of the neural network.

An exemplary embodiment of the method for generating perturbed inputdata 9 will be explained with reference to FIG. 4:

In a step S1, a first metric is defined, which specifies how the extentof a change to digital images is measured. The first metric or a dataset describing the first metric is stored in the first metric unit 1.

In a step S2, a second metric is defined, which specifies what aperturbation of the digital images is directed at. This second metric ora data set describing the second metric is stored in the second metricunit 2.

Finally, in a step S3, a third metric is defined, which specifies whattype of digital images a perturbation is used for. This third metric ora data set describing said third metric is stored in the third metricunit 3.

In a step S4, the data sets that describe the three metrics aretransmitted to the processing unit 4.

In a step S5, the processing unit 4 generates an optimization problemfrom a combination of the three metrics. In a step S6, the processingunit 4 transmits a data set that describes the generated optimizationproblem to the solution unit 5.

In a step S7, the solution unit 5 solves the optimization problem bymeans of at least one solution algorithm that was transmitted to thesolution unit 5 for example by accessing the database 6. The solution isa target perturbation for digital images.

In a step S8, a data set for this target perturbation is transmitted tothe generation unit 7.

In a step S9, the generation unit 7 generates perturbed digital imagesas input data 9 for a neural network by accessing the database 8. Theseperturbed input data 9 are output in a step S10.

In the following, the method will be explained in detail based on anexample in which objects of the pedestrian class are enlarged:

In the following, the method will be explained in detail with referenceto FIG. 5A to 5C based on an example in which objects of the pedestrianclass are enlarged:

A model M is provided. This model has the input x. This input x is adigital image of the like shown in FIG. 5A. Furthermore, the outputM(x)=y is defined. A perturbation is denoted by Δ, such that the alteredinput x′=x+Δ is produced. The altered output is thus y′=M(x+Δ). Thetarget output is denoted by y″.

FIG. 5B shows the output y of the model M. The digital image x has beensegmented, i.e. classes have been assigned to the pixels of the digitalimage x, as shown in FIG. 5B. The following class assignments resulted:

K1: Sky;

K2: Nature;

K3: Building;

K4: Pedestrian;

K5: Traffic sign;

K6: Road;

K7: Marking.

The target output y″, which is to be generated by means of theperturbation Δ, is shown in FIG. 5C. The aim of the perturbation Δ is toshow the pedestrian enlarged. A shift of individual pixel values by thevalue of at most 3 is defined as the target perturbation. The targetdata consist of a concrete image x.

The first metric is then defined as follows:

${d_{1}(\Delta)} = {{\Delta }_{\infty} = {\max\limits_{pixel}{❘{\Delta({pixel})}❘}}}$

The magnitude of the perturbation is thus measured as the maximum pixelvalue between 0 and 255 in the perturbation Δ.

The second metric is defined as follows:

${d_{2}(\Delta)} = {{{{M\left( {x + \Delta} \right)} - y^{''}}}_{1} = {{{y^{\prime} - y^{''}}}_{1} = {\sum\limits_{pixel}{❘{{y^{\prime}({pixel})} - {y^{''}({pixel})}}❘}}}}$

It defines the sum of the pixel deviations from the target output.

The third metric is defined as follows:

${d_{3}\left( x^{\prime} \right)} = \left\{ \begin{matrix}{0;{x^{\prime} = x}} \\{1;{x^{\prime} \neq x}}\end{matrix} \right.$

Thus, according to this third metric, only the input image x has a smallsize. Consequently, the attack only applies to the input image x ifd₃(x′)<1 is stipulated. The focus with regard to the data to be attackedchanges dramatically if d₃(x′)<2 is stipulated: In this case, the attackapplies to all images.

The optimization problem is then formed from these three metrics asfollows:

$\overset{\_}{\Delta} = {\underset{{d_{1} < 3};{{d_{3}(x^{\prime})} < 1}}{argmin}\left( {d_{2}(\Delta)} \right)}$

According to the optimization problem, a Δ is to be found such thatd₂(Δ) is minimal, wherein d₁(Δ)<3 is on x.

This optimization problem may be solved using solution algorithms thatare known per se. This produces a new adversarial perturbation fromalready known (d₁, d₃) and new (d₂) metrics. Furthermore, by recombiningalready known metrics (d₁, . . . , d₃) in a novel manner or by linkingthem to another solution algorithm, new adversarial perturbations mayalso be created. The method thus makes it possible to construct almostany number of novel adversarial perturbations in a simple manner.

According to one variant of this example, for the first metric, it ispossible only to allow pixel changes in an image region that areclassified as “tree”. This produces the following optimization problem:A Δ is to be found in “tree” image regions in the digital image x suchthat d₂(Δ) is minimal, with d₁(Δ)<3.

According to another variation of this example, it is possible to searchfor a perturbation for all images for the third metric, with the firstmetric d₁ and the second metric d₂ left unchanged. The optimizationproblem may then be formulated as follows: A Δ is to be found such thatd₂(Δ) is minimal for all images, with d₁(Δ)<3. In other words, a Δ is tobe found with d₁(Δ)<3 such that the model output for all input images xlooks like y″.

An exemplary embodiment of a device for generating a set of parametersfor a neural network will be described below with reference to FIG. 6:

The device comprises the database 8 with digital images. The generator10 described with reference to FIG. 3 is connected to said database 8. Aneural network 11 is coupled to the database 8 and the generator 10. Theoutput of the neural network 11 is coupled to a first analysis unit 12and a second analysis unit 13. The first analysis unit 12 generates afirst analysis by means of the neural network 11 on the basis of digitalimages which are fed to the neural network 11 as input data from thedatabase 8. The second analysis unit 13 generates a second analysis onthe basis of perturbed input data 9 fed to the neural network 11 fromthe generator 10. In order to generate the perturbed input data 9, thegenerator 10 accesses the database 8 with the digital images and appliesthe target perturbation generated by the generator 10 to said images.

The first analysis unit 12 and the second analysis unit 13 are coupledto a comparison unit 14. Said comparison unit is designed to compare thefirst and second analysis with one another.

The comparison unit 14 is coupled to a parameter set generation unit 15.The parameter set generation unit 15 is designed to generate an improvedset of parameters for the neural network 11 on the basis of the resultof the comparison of the first and second analysis that was transmittedfrom the comparison unit 14. The set of parameters for the neuralnetwork 11 is generated by the parameter set generation unit 15 suchthat the perturbed input data 9 of the digital images generated by thegenerator 10 have little influence on the analysis of said input data bymeans of the neural network 11. In particular, the improved set ofparameters is generated such that the effects of the perturbed inputdata 9 on the semantic segmentation of the digital image by means of theneural network 11 for the perturbed input data does not result insafety-related objects being incorrectly classified for a driverassistance system, or in these objects disappearing or being displayeddifferently. The neural network 11 may therefore be trained by means ofthe perturbed input data 9 generated by the generator 10.

A method for improving a set of parameters of a neural network will bedescribed below with reference to FIG. 7:

In a step R1, a neural network is provided with an associated set ofparameters. This neural network is to be checked.

In a step R2, training data are generated by means of a large number ofdigital images.

In a step R3, the neural network is trained with training data in amanner known per se and a first analysis of the digital images isgenerated by means of the neural network on the basis of the trainingdata.

In a step R4, perturbed input data are generated as training data forthe digital images by means of the method as explained with reference toFIG. 4.

In a step R5, a second analysis of the digital images is generated bymeans of the neural network on the basis of the perturbed input data,i.e. on the basis of the digital images to which the target perturbationwas applied.

In a step R6, the first and the second analysis are compared with oneanother.

In a step R8, an improved set of parameters is generated for the neuralnetwork on the basis of the result of the comparison of the first andsecond analysis.

In the following, another exemplary embodiment of the generator 10 andof the method for generating perturbed input data 9 will be explained:

The generator 10 of the other exemplary embodiment comprises a firstmetric unit 1 and a second metric unit 2, as in the first exemplaryembodiment. However, in this case, the first metric unit 1 comprises afirst group having a large number of first metrics that each provide adifferent specification as to how the extent of a change to sensor datais measured. In this case, the second metric unit 2 comprises a secondgroup having a large number of second metrics that each provide adifferent specification as to what a perturbation of the input data 9from sensor data is directed at. The processing unit 4 coupled to thefirst 1 and second 2 metric unit is in this case designed to generatethe optimization problem from any combination of a first metric from thefirst group and a second metric from the second group.

The solution unit 5 coupled to the processing unit 4 is designed tosolve the optimization problem by means of at least one solutionalgorithm, wherein the solution specifies a target perturbation of theinput data 9 from sensor data. As with the first exemplary embodiment,the generation unit 7 is also designed to generate perturbed input data9 for a neural network 11 from sensor data by means of the targetperturbation.

The method of the other exemplary embodiment proceeds in a similarmanner to the method of the first exemplary embodiment. However, in thiscase, a first group is defined which contains the first metrics whicheach provide a different specification as to how the extent of a changeto sensor data is measured. Furthermore, a second group is defined whichcontains the second metrics which each provide a different specificationas to what a perturbation of sensor data is directed at. Then, anycombination of a first metric from the first group and a second metricfrom the second group is selected and the optimization problem isgenerated from the selected combination of the first and second metric.Said optimization problem is then solved in the same way as in themethod of the first exemplary embodiment by means of at least onesolution algorithm, wherein the solution specifies a target perturbationof the input data 9. By means of the target perturbation, perturbedinput data 9 are generated for the neural network 11 from sensor data.

LIST OF REFERENCE NUMERALS

1 First metric unit

2 Second metric unit

3 Third metric unit

4 Processing unit

5 Solution unit

6 Database with solution algorithms

7 Generation unit

8 Database with digital image data

9 Perturbed input data

10 Generator

11 Neural network

12 First analysis unit

13 Second analysis unit

14 Comparison unit

15 Parameter set generation unit

16 Database with perturbations

20 Driver assistance system

21 Sensor unit

22 Verification unit

23 Plausibility unit

24 Supplementary sensor unit

25 Interface for supplementary sensor data

26 Evaluation unit

27 Control unit

28 Actuators

The invention has been described in the preceding using variousexemplary embodiments. Other variations to the disclosed embodiments maybe understood and effected by those skilled in the art in practicing theclaimed invention, from a study of the drawings, the disclosure, and theappended claims. In the claims, the word “comprising” does not excludeother elements or steps, and the indefinite article “a” or “an” does notexclude a plurality. A single processor, module or other unit or devicemay fulfil the functions of several items recited in the claims.

The term “exemplary” used throughout the specification means “serving asan example, instance, or exemplification” and does not mean “preferred”or “having advantages” over other embodiments. The term “in particular”used throughout the specification means “serving as an example,instance, or exemplification”.

The mere fact that certain measures are recited in mutually differentdependent claims or embodiments does not indicate that a combination ofthese measures cannot be used to advantage. Any reference signs in theclaims should not be construed as limiting the scope.

What is claimed is:
 1. A method for operating a driver assistance systemof a vehicle, comprising: recording sensor data successively from thesurroundings of the vehicle; verifying the recorded sensor data;analyzing the verified sensor data using a neural network and generatinganalyzed sensor data; and based on the analyzed sensor data, generatingcontrol data for controlling the vehicle in a partially automated orfully automated manner; wherein during verification of the sensor data,at least first sensor data, which were recorded at a first, earlierpoint in time, are compared with second sensor data, which were recordedat a second, later point in time; and the result of the comparison iscross-checked with data of a database in which data on perturbations toinput data of a neural network are stored, wherein it is determinedwhether the second sensor data were generated at least in part by aperturbation to the first sensor data that is stored in the database. 2.The method claim 1, wherein the sensor data are digital images of acamera of the vehicle and the digital images record the surroundings ofa vehicle.
 3. The method of claim 1, wherein the data stored in thedatabase describe naturally occurring perturbations.
 4. The method ofclaim 1, comprising checking the verified sensor data for plausibilityin that supplementary sensor data are obtained from the surroundings ofthe vehicle, the supplementary sensor data are analyzed, deviations ofthe second sensor data from the first sensor data are determined, and itis determined whether the deviations are in line with the analysis ofthe supplementary sensor data.
 5. The method of claim 1, comprisingduring the analysis of the supplementary sensor data, obtainingvisibility conditions in the surroundings of the vehicle and determiningwhether the deviations of the second sensor data from the first sensordata at least partially result from the visibility conditions in thesurroundings of the vehicle.
 6. The method of claim 1, wherein animproved set of parameters of the neural network is generated by:providing a neural network with an associated set of parameters;generating training data using an example sensor data set; generating afirst analysis of the example sensor data set on the basis of thetraining data using the neural network; generating perturbed input dataas training data for the example sensor data set; generating a secondanalysis of the example sensor data set on the basis of the perturbedinput data using the neural network; comparing the first and secondanalysis; and generating an improved set of parameters for the neuralnetwork on the basis of the result of the comparison of the first andsecond analysis; wherein the perturbed input data are generated in that:a first metric is defined, which specifies how the extent of a change tosensor data is measured; a second metric is defined, which specifieswhat a perturbation of sensor data is directed at; an optimizationproblem is generated from a combination of the first metric and thesecond metric; the optimization problem is solved using at least onesolution algorithm, wherein the solution specifies a target perturbationof the input data, and perturbed input data are generated for the neuralnetwork from sensor data using the target perturbation.
 7. The method ofclaim 1, wherein an improved set of parameters of the neural network isgenerated by: providing a neural network with an associated set ofparameters; generating training data using an example sensor data set;generating a first analysis of the example sensor data set on the basisof the training data using the neural network; generating perturbedinput data as training data for the example sensor data set; generatinga second analysis of the example sensor data set on the basis of theperturbed input data using the neural network; comparing the first andsecond analysis; and generating an improved set of parameters for theneural network on the basis of the result of the comparison of the firstand second analysis, wherein the perturbed input data are generated inthat: a first group is defined, which contains first metrics that eachprovide a different specification as to how the extent of a change tosensor data is measured; a second group is defined, which containssecond metrics that each provide a different specification as to what aperturbation of sensor data is directed at; any combination of a firstmetric from the first group and a second metric from the second group isselected; an optimization problem is generated from the selectedcombination of the first and second metric; the optimization problem issolved using at least one solution algorithm, wherein the solutionspecifies a target perturbation of the input data; and perturbed inputdata are generated for the neural network from sensor data by means ofthe target perturbation.
 8. The method of claim 6, wherein semanticsegmentation of the digital image is carried out during the first andsecond analysis in each case.
 9. The method of claim 7, wherein a thirdmetric is defined, which specifies what type of sensor data aperturbation is used for; and the optimization problem is generated froma combination of at least two metrics from the first, second and thirdmetric.
 10. A driver assistance system for a vehicle, comprising: asensor unit arranged in the vehicle for recording sensor data of thesurroundings of the vehicle; a verification unit for verifying therecorded sensor data, wherein the verification unit, during verificationof the sensor data, is configured to compare at least first sensor datathat were recorded at a first, earlier point in time with second sensordata that were recorded at a second, later point in time, to cross-checkthe result of the comparison with data of a database in which datarelating to perturbations of input data of a neural network are stored,wherein it is determined whether the second sensor data were generatedat least in part by a perturbation to the first sensor data that isstored in the database; an evaluation unit, which is coupled to thesensor unit and in which a neural network is stored and which isconfigured to analyze the verified sensor using the neural network andthereby generate analyzed sensor data; a control unit, which is coupledto the evaluation unit and which is configured to generate control datafor controlling the vehicle in a partially automated or fully automatedmanner on the basis of the analyzed sensor data.
 11. The driverassistance system of claim 10, wherein the sensor unit is a camera forrecording digital images, wherein the digital images record thesurroundings of a vehicle.
 12. The driver assistance system of claim 10,wherein the verification unit is configured to determine deviations ofthe second sensor data from the first sensor data; the driver assistancesystem comprises a supplementary sensor unit, which is configured toobtain supplementary sensor data from the surroundings of the vehicle;and the driver assistance system also comprises a plausibility unit,which is coupled to the supplementary sensor unit and to theverification unit and which is configured to analyze the supplementarysensor data and to determine whether the deviations are in line with theanalysis of the supplementary sensor data.
 13. The method of claim 2,wherein the data stored in the database describe naturally occurringperturbations.
 14. The method of claim 2, comprising checking theverified sensor data for plausibility in that supplementary sensor dataare obtained from the surroundings of the vehicle, the supplementarysensor data are analyzed, deviations of the second sensor data from thefirst sensor data are determined, and it is determined whether thedeviations are in line with the analysis of the supplementary sensordata.
 15. The method of claim 3, comprising checking the verified sensordata for plausibility in that supplementary sensor data are obtainedfrom the surroundings of the vehicle, the supplementary sensor data areanalyzed, deviations of the second sensor data from the first sensordata are determined, and it is determined whether the deviations are inline with the analysis of the supplementary sensor data.
 16. The methodof claim 2, comprising during the analysis of the supplementary sensordata, obtaining visibility conditions in the surroundings of the vehicleand determining whether the deviations of the second sensor data fromthe first sensor data at least partially result from the visibilityconditions in the surroundings of the vehicle.
 17. The method of claim3, comprising during the analysis of the supplementary sensor data,obtaining visibility conditions in the surroundings of the vehicle anddetermining whether the deviations of the second sensor data from thefirst sensor data at least partially result from the visibilityconditions in the surroundings of the vehicle.
 18. The method of claim4, comprising during the analysis of the supplementary sensor data,obtaining visibility conditions in the surroundings of the vehicle anddetermining whether the deviations of the second sensor data from thefirst sensor data at least partially result from the visibilityconditions in the surroundings of the vehicle.
 19. The method of claim2, wherein an improved set of parameters of the neural network isgenerated by: providing a neural network with an associated set ofparameters; generating training data using an example sensor data set;generating a first analysis of the example sensor data set on the basisof the training data using the neural network; generating perturbedinput data as training data for the example sensor data set; generatinga second analysis of the example sensor data set on the basis of theperturbed input data using the neural network; comparing the first andsecond analysis; and generating an improved set of parameters for theneural network on the basis of the result of the comparison of the firstand second analysis; wherein the perturbed input data are generated inthat: a first metric is defined, which specifies how the extent of achange to sensor data is measured; a second metric is defined, whichspecifies what a perturbation of sensor data is directed at; anoptimization problem is generated from a combination of the first metricand the second metric; the optimization problem is solved using at leastone solution algorithm, wherein the solution specifies a targetperturbation of the input data, and perturbed input data are generatedfor the neural network from sensor data using the target perturbation.20. The method of claim 3, wherein an improved set of parameters of theneural network is generated by: providing a neural network with anassociated set of parameters; generating training data using an examplesensor data set; generating a first analysis of the example sensor dataset on the basis of the training data using the neural network;generating perturbed input data as training data for the example sensordata set; generating a second analysis of the example sensor data set onthe basis of the perturbed input data using the neural network;comparing the first and second analysis; and generating an improved setof parameters for the neural network on the basis of the result of thecomparison of the first and second analysis; wherein the perturbed inputdata are generated in that: a first metric is defined, which specifieshow the extent of a change to sensor data is measured; a second metricis defined, which specifies what a perturbation of sensor data isdirected at; an optimization problem is generated from a combination ofthe first metric and the second metric; the optimization problem issolved using at least one solution algorithm, wherein the solutionspecifies a target perturbation of the input data, and perturbed inputdata are generated for the neural network from sensor data using thetarget perturbation.